[jira] [Updated] (WW-4596) Strict DMI causes This method: for action is not allowed!

["Greg Huber (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WW-4596?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Greg Huber updated WW-4596:
---------------------------
    Description: 
I have tried adding

<global-allowed-methods>execute,input,cancel</global-allowed-methods>

and get

This method: cancel for action eventAdd is not allowed! - [unknown location]

<action name="eventAdd!*" method="{1}"
                class="ui.struts2.editor.EventAdd">
            <result name="input" type="tiles">.EventAdd</result>
            <result name="success" type="chain">eventEdit</result>
            <result name="cancel" type="redirectAction">
                <param name="actionName">memberEvents</param>
                <param name="pgn">${bean.pageNum}</param>
                <param name="suppressEmptyParameters">true</param>
            </result>
        </action>

checking ActionConfig:

public boolean isAllowedMethod(String method) {
        return method.equals(methodName != null ? methodName : DEFAULT_METHOD) || allowedMethods.isAllowed(method);
    }


Debugging  I get a calls to isAllowedMethod with :

1 methodName = {1}​ and method = execute
2 methodName = execute and method = cancel

​Only #1 has the required cancel
#2 there is only a [LiteralAllowedMethod{allowedMethod='execute'}]​

On further investigation com.opensymphony.xwork2.config.implActionConfigMatcher seems to create a new ActionConfig but then only uses the default allowed names:

return new ActionConfig.Builder(pkgName, orig.getName(), className)
                .methodName(methodName)
                .addParams(params)
                .addResultConfigs(results)
                .addInterceptors(orig.getInterceptors())
                .addExceptionMappings(exs)
                .location(orig.getLocation())
                .build();

Could use the original by appending .addAllowedMethod(orig.getAllowedMethods()), but I guess it should come from the ActionConfig stored in the packageContext or wherever the orig object gets its allowedMethods from.

Cheers Greg






> Strict DMI causes This method: for action is not allowed!  
> -----------------------------------------------------------
>
>                 Key: WW-4596
>                 URL: https://issues.apache.org/jira/browse/WW-4596
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Core Actions
>    Affects Versions: 2.5
>            Reporter: Greg Huber
>
> I have tried adding
> <global-allowed-methods>execute,input,cancel</global-allowed-methods>
> and get
> This method: cancel for action eventAdd is not allowed! - [unknown location]
> <action name="eventAdd!*" method="{1}"
>                 class="ui.struts2.editor.EventAdd">
>             <result name="input" type="tiles">.EventAdd</result>
>             <result name="success" type="chain">eventEdit</result>
>             <result name="cancel" type="redirectAction">
>                 <param name="actionName">memberEvents</param>
>                 <param name="pgn">${bean.pageNum}</param>
>                 <param name="suppressEmptyParameters">true</param>
>             </result>
>         </action>
> checking ActionConfig:
> public boolean isAllowedMethod(String method) {
>         return method.equals(methodName != null ? methodName : DEFAULT_METHOD) || allowedMethods.isAllowed(method);
>     }
> Debugging  I get a calls to isAllowedMethod with :
> 1 methodName = {1}​ and method = execute
> 2 methodName = execute and method = cancel
> ​Only #1 has the required cancel
> #2 there is only a [LiteralAllowedMethod{allowedMethod='execute'}]​
> On further investigation com.opensymphony.xwork2.config.implActionConfigMatcher seems to create a new ActionConfig but then only uses the default allowed names:
> return new ActionConfig.Builder(pkgName, orig.getName(), className)
>                 .methodName(methodName)
>                 .addParams(params)
>                 .addResultConfigs(results)
>                 .addInterceptors(orig.getInterceptors())
>                 .addExceptionMappings(exs)
>                 .location(orig.getLocation())
>                 .build();
> Could use the original by appending .addAllowedMethod(orig.getAllowedMethods()), but I guess it should come from the ActionConfig stored in the packageContext or wherever the orig object gets its allowedMethods from.
> Cheers Greg



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)